Privacy Policy

Last updated: October 6, 2026 · Versão em português

This is an English translation of the Portuguese privacy policy. If there is any difference between the two versions, the Portuguese version prevails.

This policy describes what information the Miva Player app collects, why it collects it and what we do with it. It applies to all versions of the app — Android, Android TV, Google TV, Amazon Fire TV, Samsung TVs (Tizen), LG TVs (webOS) and Roku. All of them talk to the same server and handle your data in the same way; where there is a difference between devices, it is indicated in the text.

Miva Player is a media player. It does not provide, host or distribute channels, movies or any other content. Everything that appears on the screen comes from the list of a provider that the user contracted themselves, on their own, outside the app.

1. Information we collect

Device identification

To bind the license to the device, we collect a device identifier. It is not created by us: it is the number that the device's own system provides to the app. Which number that is depends on the platform:

Device	Identifier used
Android, Android TV, Google TV, Fire TV	ANDROID_ID, assigned by the system
Samsung TVs (Tizen)	the device's factory identifier
LG TVs (webOS)	the device's factory identifier
Roku	GetChannelClientId, unique per device and per app

When the device does not provide any of these values, the app draws a random number on first run and stores it only on the device itself, to serve as identification. Whatever its origin, the identifier is decided only once and stored: if the system later starts returning a different value, the one already stored remains in effect, so that your license is not lost.

We also collect the manufacturer and model of the device, the app version and the platform. The app does not collect IMEI, MAC address, phone number, contacts, calendar, location, or any advertising identifier, and it only receives an e-mail address in the Roku situation described below.

This identifier changes if the app is uninstalled and reinstalled, or if the device is factory reset. On Roku it is different: there it survives reinstallations and updates of the app, and is only reset by a factory reset of the TV. On Samsung TVs as well: the factory identifier remains the same after uninstalling and reinstalling the app, and for that reason the registered lists reappear; to unlink the device, remove the lists in My lists (Minhas listas) or request deletion through the contact below. When the identifier changes, the device is then seen as a new one, with a new activation code.

Roku account e-mail (Roku only, optional). The first time the sign-in screen opens, Roku shows its own standard screen asking whether you want to share your Roku account e-mail with Miva Player. The question appears only once per device. Declining changes nothing: access continues to be by provider code, username and password. If you accept, we store that e-mail together with the device record, only for support contact about it. We do not send advertising, we do not show it to the reseller or to the provider, and the e-mail is deleted together with the device record.

Access data for your provider

To register a list, the user enters in the app a 6-digit provider code, the username and the password of the account they contracted. The server address is not typed by the user: our panel tells the app the servers of that provider, and the app tests, from the device itself and with the username and password entered, on which of them the account exists.

Together with the registration, the app sends our panel the result of each attempt — which server was tested, whether it recognized the account, the response code and how long it took. This is used only for diagnosis, when a registration does not work.

This data — server address, username and password — is stored on our server, associated with the device. It exists so that the list keeps working without the user typing everything again on the remote control, and for the validity check described in section 2.

About the protection of these passwords. Today this data is recorded in our database without encryption. Access to the database is restricted and protected by password, but we prefer to state this clearly rather than give the impression of a protection that does not yet exist. These are credentials of your provider, not ours: if you prefer not to keep them stored, remove the list through the app — it is deleted from our server as well.

Status of your lists

The app tells our server whether each registered list loaded and until when the provider says the account is valid. Normally this happens once every 12 hours; it happens sooner — with a minimum interval of a few minutes — when a list stops loading or when the lists on the device change. What is sent is the identifier of the list in our panel, whether it responded, the expiry date, the error code when there is one and, when the provider reports it, the reason (for example, expired account).

This exists because the validity of the app can follow the validity of your list. Nothing about what you watch is sent — no channel, title, time or playback history. (The only usage data is the total minutes of live TV for the day, described in “Live TV performance”, just below.)

Server address in use

In the Android versions from 1.14.18 onwards and on Samsung and LG TVs from 1.3.0 onwards, the app tells our server, together with the license query, which provider address each list is using, since when and the reason for the last switch (for example, the previous address did not respond). It is used for support and for the automatic address switch: when your provider's server has more than one address registered in our panel, the app uses the one that is working on your connection. This is only sent when the address changes, or once a day.

It is used so the reseller can see what is in use before changing the list, and to notice when an address has stopped working in a region. It does not include what you watch, username, password or IP address.

Live TV performance (anti-freeze / live buffering)

In the Android versions from 1.14.19 onwards and on Samsung and LG TVs from 1.3.0 onwards, when this measurement is turned on in our panel, the app sends a summary per day and per list of how live TV playback behaved: for how many minutes live TV was playing during the day, how many seconds of video the app kept stored (average and minimum; Samsung and LG TVs do not have this information and do not send it), how much the provider's server makes available, how many times the connection failed without the picture stopping and how many times the picture stopped to load, the stream format, the playback settings, whether the device has little memory and the app version. The sending happens together with the license query, at most a few times a day.

It is used to measure and improve the anti-freeze per provider and per type of device. It does not include channel, title, program, the time at which you watched or IP address — only the total for the day.

Parental control

In the Android versions and on Samsung and LG TVs from 1.3.0 onwards (where the modes are only off and hide), the app tells our server the state of the parental control on the device: the mode chosen (off, ask for password or hide), whether a password exists and when the mode changed and by whom (on the device itself or by the reseller). The password created on the device is never sent — only the information that it exists. This allows the reseller to see how the control is today, and not only what they requested the last time.

In these versions, the reseller can, through the panel, turn the parental control on or off for a device, to help a customer who does not know how to do this on the TV. Along with it, they can provide a password for a device that does not yet have one. That password is stored on our server, without encryption, only until the device confirms that it already has a password — at that moment it is deleted automatically. If the device already has a password, the one sent by the reseller is not used. Once applied, the customer remains free to change the control on the device itself.

Queries to your provider's server

In addition to the report made by the app, our server also periodically queries your provider's server, using the stored credentials, only to ask whether the account is still valid and until when. These queries go directly from our server to the provider's server, without intermediaries.

The query reads only the status and the expiry date of the account. We do not download, store or redistribute the content of your list.

Access logs

Our server records, on each query from the app, the IP address, the date and time, the action requested, the identification of the program that made the request (user agent) and a short technical message about the result. They are used for technical diagnosis and to contain abusive use, such as automated attempts to discover activation codes.

Deletion log

When a device is removed from the panel by the administrator, we keep a record of the removal: the activation code, the device identifier, the reseller, the license type, and who removed it, when and from which IP address. It is an internal audit trail, so that no deletion happens without a trace.

2. Information that stays only on the device

It is not sent to any server and disappears if the app is uninstalled:

Channels, movies and series marked as favorites
Position at which a movie or episode was interrupted, its duration, whether it was watched to the end and when it was last watched, together with the title, the cover and, for episodes, the season and the number — used only for the Continue (Continuar) buttons, the watched mark and the Continue watching (Continuar assistindo) row on the home screen
Parental control password created on the device (when the reseller sends a password through the panel, see “Parental control” in section 1)
Playback and appearance preferences, among those that the version for your device offers (stream format, video buffer, brightness, subtitles, preview, home screen and covers per row)
Content downloaded from the list, stored temporarily so the app opens faster

All of this can be deleted by the user themselves in Settings › Your data (Ajustes › Seus dados), in the versions that have that screen. Uninstalling the app also deletes everything, on any device.

3. What we do not do

We do not display advertising
We do not use third-party behavior analysis or tracking tools
We do not sell, rent or share data with third parties for commercial purposes
We do not monitor what the user watches: no channel, title or time is sent
We do not access files, photos, camera, microphone or location

In the Android versions, the only permissions the app requests from the system are internet access and checking the network state. On Samsung TVs, LG TVs and Roku the app uses only the network connection and the storage space reserved for it by the system itself; it does not request or receive access to files, camera, microphone or location.

4. How we use the information

To check the status of the device's license
To follow the validity of the list, when the license follows its validity
To deliver to the app the lists that the user themselves registered
To provide support when requested
To diagnose failures and contain abuse
To measure and improve the live TV anti-freeze, per provider and per type of device

5. Who we share with

With the reseller who sold your access. They see, in the panel, the activation code, the device model, the license status, the registered lists and the state of the parental control (without the password). The live TV performance summary is not shown to the reseller: only the Miva Player administration sees it, and the same applies to the Roku account e-mail, when you share it. They can also change the server of the lists when the provider changes address, set app settings (such as the home screen and the channel preview) and, in the Android versions and on Samsung and LG TVs from 1.3.0 onwards, turn the parental control on or off, as described in section 1. This is what allows them to provide support and renew your access.

With your provider's server. When playing the list, the device connects directly to it, and it will see your IP address as it would in any other player. This connection does not pass through us, and we have no control over what that provider records. We recommend consulting its privacy policy.

The app also downloads cover images from the addresses given by the user's list. These images come from the provider's server, not from us.

6. How long we keep it

Registered lists: until they are removed, by the user in the app or by the reseller in the panel
Server address in use: for as long as the list exists; it is deleted together with it
Device and license data: for as long as the license exists, or until the user requests deletion
Roku account e-mail (if you shared it): for as long as the device record exists; it is deleted together with it
Device deletion log: kept as an audit trail
Parental control password sent by the reseller: deleted automatically as soon as the device confirms that it already has a password

Access logs (IP, date, action and user agent): deleted automatically after 30 days, by a daily routine on our server
Live TV performance summary: deleted automatically after 90 days, by the same routine

7. Security

Communication between the app and our server is done over HTTPS and each request is cryptographically signed, which prevents a third party from passing itself off as the app. Administrative access to the panel is restricted and protected by password.

As stated in section 1, the credentials of the user's list are recorded without encryption in the database. No system is completely immune: if an incident occurs that affects personal data, we will notify those involved and the competent authorities.

8. User rights

Under the Brazilian General Data Protection Law (LGPD) (Law 13.709/2018), the user may request confirmation of the processing, access, correction, portability and deletion of their data. In practice:

The lists can be removed at any time in My lists, inside the app — which also deletes them from our server
The data stored on the device can be deleted in Settings › Your data (on Samsung and LG TVs: Settings › Data (Ajustes › Dados))
Uninstalling the app deletes everything that was stored on the device
To delete the device record on our server, just ask through the contact below, giving the 6-character code shown on the app screen. The request is fulfilled within 7 business days

Since we do not store your name (and the e-mail only exists if you shared it on Roku), it is the device code that allows us to locate your record.

The step-by-step for the deletion request is described in Support › I want to delete my data (Suporte › Quero apagar meus dados) (in Portuguese).

9. Legal basis

We process your data under the following legal bases provided for in the LGPD:

Performance of a contract (art. 7, V) — to bind the license to the device, store and deliver the lists you registered, check the validity of your account with the provider and provide support. Without this data the service simply does not work.
Legitimate interest (art. 7, IX) — for the access logs, used for security, failure diagnosis and abuse prevention, such as automated attempts to discover activation codes of other devices. We keep the minimum necessary for this purpose and delete it within the period in section 6.

10. Children

The app is not directed at children under 13 and does not knowingly collect data from children. Since the content comes from the user's own list, and not from us, it may contain adult material.

The app offers a parental control with password, which locks or hides the adult content categories. The feature is available in the Android, Android TV, Fire TV, Samsung and LG versions. In the Android versions and on Samsung and LG TVs from 1.3.0 onwards, the reseller can turn it on or off through the panel at the customer's request, and the customer can change it afterwards on the device itself, with the password.

11. Changes to this policy

We may update this text. When that happens, the date at the top will be changed. Relevant changes will be communicated through our support channels.

12. Contact

The controller of the data processed under this policy — the one who decides what is collected, for what purpose, and answers the requests below — is Carlos Mailson Ferreira Oliveira, who operates the Miva Player service.

Questions about this policy or requests related to your data:
[email protected]
São José de Ribamar, Maranhão, Brazil

Miva Player — media player. The app does not provide content.